English | Русский

IPSec

Configuration files are based on https://github.com/hwdsl2/setup-ipsec-vpn.git

Sponsors

Client Configuration Files

UPDATE: Currently we need only one configuration files, you don't need to manually choose server

Windows:

Config import script: ikev2_config_import (Copyright (C) 2022 Lin Song)

• p12 / Server: lt.fuckrkn1.xyz

iOS:

• mobile

Android:

• sswan

Installation

• Windows 7, 8, 10 and 11
• OS X (macOS)
• iOS (iPhone/iPad)
• Android
• Linux

Windows 7, 8, 10 and 11

1. Download the vpnclient.p12 file to your device.
2. Download config import script and put it in the same folder as p12 file.
3. Right-click on the saved script, select Properties. Click on Unblock at the bottom, then click on OK.
4. Right-click on the saved script, select Run as administrator.
5. Choose the VPN client name (or just press Enter, it will choose the file's name)
6. Enter IP of the server, you can find it in the here
7. Choose the VPN connection name (or just press Enter, script will choose default name)
8. Press any key to finish script. To connect to the VPN: Right-click on the wireless/network icon in your system tray, open settings, go to the VPN, select the new entry, and click Connect.

windows-screencast.mov

OS X (macOS)

1. Download the vpnclient.mobileconfig file to your device.
2. Double-click it, you'll get a OS notification.
3. Open  → System Preferences → Profiles and install the profile.
4. Open  → System Preferences → Network and connect.

macos-screencast.mov

iOS (iPhone/iPad)

1. Download the vpnclient.mobileconfig file to your device.
2. Move the file to the "On my iPhone" folder.
3. Open Settings and install the profile.
4. Go to Settings > VPN and connect.

ios2.mov

Android

1. Download strongSwan VPN Client from Google Play.
2. Download vpnclient.sswan file to your device.
3. Press the button in the top right corner > Import VPN profile > Choose the file.
4. Choose the VPN certificate.
5. Connect to the VPN.

andorid-screencast.mov

Linux

Via Network Manager

To configure your Linux computer to connect to IKEv2 as a VPN client, first install the strongSwan plugin for NetworkManager:

# Ubuntu and Debian
sudo apt-get update
sudo apt-get install network-manager-strongswan

# Arch Linux
sudo pacman -Syu  # upgrade all packages
sudo pacman -S networkmanager-strongswan

# Fedora
sudo yum install NetworkManager-strongswan-gnome

# CentOS
sudo yum install epel-release
sudo yum --enablerepo=epel install NetworkManager-strongswan-gnome

Next, securely transfer the generated .p12 file from the repository to your Linux computer. After that, extract the CA certificate, client certificate and private key. Replace vpnclient.p12 in the example below with the name of your .p12 file.

# Example: Extract CA certificate, client certificate and private key.
#          You may delete the .p12 file when finished.
# Note: You may need to enter the import password, which can be found
#       in the output of the IKEv2 helper script. If the output does not
#       contain an import password, press Enter to continue.
openssl pkcs12 -in vpnclient.p12 -cacerts -nokeys -out ikev2vpnca.cer
openssl pkcs12 -in vpnclient.p12 -clcerts -nokeys -out vpnclient.cer
openssl pkcs12 -in vpnclient.p12 -nocerts -nodes  -out vpnclient.key
rm vpnclient.p12

# (Important) Protect certificate and private key files
# Note: This step is optional, but strongly recommended.
sudo chown root.root ikev2vpnca.cer vpnclient.cer vpnclient.key
sudo chmod 600 ikev2vpnca.cer vpnclient.cer vpnclient.key

You can then set up and enable the VPN connection:

1. Go to Settings -> Network -> VPN. Click the + button.
2. Select IPsec/IKEv2 (strongswan).
3. Enter anything you like in the Name field.
4. In the Gateway (Server) section, enter Your VPN Server IP (or DNS name) for the Address. / you can find it here
5. Select the ikev2vpnca.cer file for the Certificate.
6. In the Client section, select Certificate(/private key) in the Authentication drop-down menu.
7. Select Certificate/private key in the Certificate drop-down menu (if exists).
8. Select the vpnclient.cer file for the Certificate (file).
9. Select the vpnclient.key file for the Private key.
10. In the Options section, check the Request an inner IP address checkbox.
11. In the Cipher proposals (Algorithms) section, check the Enable custom proposals checkbox.
12. Leave the IKE field blank.
13. Enter aes128gcm16 in the ESP field.
14. Click Add to save the VPN connection information.
15. Turn the VPN switch ON.